General

  • Target

    11936739923.zip

  • Size

    76KB

  • Sample

    230928-k4erzabc48

  • MD5

    18ce3829f812c34abb7acb96b0e1639d

  • SHA1

    cff65c18d99005f5364815fb185985c2f945b41c

  • SHA256

    36f5ba915981ae3b43305297a53ca93a72a71497b8952bcfa87960f668e02301

  • SHA512

    f504be8b219494a756e2025340efa6313403417f857922da5bb310d11d20f6eb1dd265d6f327a8e4febc0e3c049f6d4d9528956ce7c7305003505643d4a57000

  • SSDEEP

    1536:Ay8UGl1okbvqAKwdyx3PxYwXBCKEdI3ivDLYll0leKwGqKH0Y3Flw:7+oEqTxfxX33CLy0F7NUyM

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming!_^_RAGNAR_README_NOTES_^_!.txt

Ransom Note
******************************************************************************************************************* HELLO Mayanei Hayeshua Medical Center ! If you reading this message, it means your network was PENETRATED and all your files has been ENCRYPTED ------------------------------------------------- | | | by R A G N A R L O C K E R ! | | | ------------------------------------------------- ******************************************************************************************************************** [ YOU HAVE TO CONTACT US via LIVE CHAT IMMEDIATELY TO RESOLVE THIS CASE AND MAKE A DEAL ] (contact information you will find at the bottom of this notes) **** WARNING **** DO NOT Hire any THIRD-PARTY NEGOTIATORS (RECOVERY Groups/FBI/Police and etc), otherwise we will close chat immediately and Publish all your Data. DO NOT Modify, rename, copy or move any files or you can DAMAGE them and decryption will be impossible. DO NOT Use any third-party or public Decryption software, it also may DAMAGE files. DO NOT Shutdown or Reset your system, it can DAMAGE files. --------------------------------------------------------------------------------------------------------------------------------------- ----[WHAT'S HAPPENED] Your security perimeter was BREACHED. Your critically important servers and hosts wasn't encrypted only to avoid any harm to your patients. However, if you will ignore this issue - we can use our backdoors and come back. This README-FILE here for you to show you our presence in your's network and avoid any silence about hacking and leakage. Also, we has DOWNLOADED about 1TB of your CONFIDENTIAL and most SENSITIVE Data, including your SQL DATABASE just in case if you will NOT PAY, than everything will be PUBLISHED in Media and/or SOLD to any third-party. WE HAS COLLECTED SUCH DATA AS: - Medicine cards, accident reports, patients private medical information, surgery and drugs prescription, dignoses - and other documents that could be made freely available for public use - Employees and Patients personal information including: Address and contacts, ID scans, Social numbers, payments - for which your company is sure to receive angry claims and class action lawsuits - Confidential internal correspondence, Finances, Emails, Passwords, Credentials, SQL Databases - all such info can be sold to a third parties and this will initiate more attacks by different kind of fraudsters or hackers. ----[WHAT SHOULD YOU DO] - You have to contact us as soon as possible (you can find contacts below) - You should purchase our decryption tool, then you will be able to restore your files. Without our Decryption keys it's impossible - You should make a Deal with us, to avoid your Sensitive Data leaks - You should stay away from any third-parties recovery soft, since it could damage files - You should avoid any scammers using our name in different communication ways. We communicate only via LIVE CHAT - You should avoid any third-party negotiators and recovery groups ----[YOUR OPTIONS] 1) IF NO CONTACT OR DEAL MADE IN 3 DAYS: Decryption key will be deleted permanently and recovery will be impossible. All your Data will be Published and/or Sold to any third-parties Information regarding vulnerabilities of your network also can be published and/or shared Such Leakage will have disastrous consequences to your business reputation. 2) If WE MAKE A DEAL: We will provide you with the Decryption Key and Manual how-to-use. We will remove all your files from our file-storage with proof of Deletion We will delete posts with your company name We guarantee to avoid sharing any details with third-parties We will provide you the penetration report and list of security-recommendations [Here are couple of screenshots just as a proofs of Data possession, you can find more in our Leak Blog] Screenshots: https://prnt.sc/gDHQXaqtj-cH https://prnt.sc/AUfqF2QJFdn1 https://prnt.sc/GAhNZAqqKlrN https://prnt.sc/amTTYUUsTIkP https://prnt.sc/vv-YFugZ9sXn https://prnt.sc/MyoJatQTPhpF https://prnt.sc/IZj1l46cnKqi ------------------------------------------------------------------------------------------------------------- LEAK BLOG ACCESS: We will provide you with the link for private Temporary leak page with some more proofs of data possession ====================================================================== [ HERE IS THE SIMPLE MANUAL HOW TO GET CONTACT WITH US VIA LIVE CHAT ] !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 1) Download and install TOR browser from this site : https://torproject.org 2) For contact us via LIVE CHAT open our website : http://ragnarmj3hlykxstyanwtgf33eyacccleg45ctygkuw7dkgysict6xyd.onion/client/?MYMC_213a_155_2023_07_08 3) To visit TEMPORARY LEAK PAGE with your data on our Leaks Blog - please request the link in Live-Chat 4) If Tor is restricted in your area, use VPN 5) All your Data will be published in 3(three) Days if NO contact made 6) Your Decryption keys will be permanently destroyed in 3(three) D
URLs

https://prnt.sc/gDHQXaqtj-cH

https://prnt.sc/AUfqF2QJFdn1

https://prnt.sc/GAhNZAqqKlrN

https://prnt.sc/amTTYUUsTIkP

https://prnt.sc/vv-YFugZ9sXn

https://prnt.sc/MyoJatQTPhpF

https://prnt.sc/IZj1l46cnKqi

http://ragnarmj3hlykxstyanwtgf33eyacccleg45ctygkuw7dkgysict6xyd.onion/client/?MYMC_213a_155_2023_07_08

Targets

    • Target

      6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576

    • Size

      84KB

    • MD5

      2a887c67f2a42c906d5216027f3af000

    • SHA1

      b6e14c4f157eda1267252c89440a3be446c47fb0

    • SHA256

      6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576

    • SHA512

      13fbe2dfeca5a3299f49dc9ec9663a50c33733d1f2fd653f75129b286c4e1b2bffa22d3e8c3d29fdc3ccb534b2ed9a27e006460c5a1336e1fcc87560dbc578b0

    • SSDEEP

      1536:q+PMmEiQ2037WAX2xKGr0Utv4JQqJvZ9LrKZNy8UMhLq:MmEP2037WfxRIxiy8hL

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Collection

Data from Local System

1
T1005

Impact

Defacement

1
T1491

Tasks